Project Blitzkrieg e-banking heist is a credible threat, McAfee says
McAfee has detected malware activity linked to an online fraud operation allegedly planned by cybercriminals
IDG News Service - Project Blitzkrieg, a coordinated attack against U.S. banking customers allegedly planned for the spring of 2013, is a real and credible threat, security researchers at McAfee have said.
A cybercriminal using the nickname "vorVzakone" announced the plan back in September on a semi-private Russian-language underground forum and invited others to join the project. The goal was to create a network of separate cybercriminal gangs that work together using the same malware and resources for a cut of the profits.
VorVzakone said at the time that the operation will target the customers of 30 U.S. banks using a Trojan program that has been in development since 2008 and has more functionality than Zeus or SpyEye -- crimeware toolkits commonly used to steal money from online banking accounts.
In a report about Project Blitzkrieg released in October, security researchers from RSA said that VorVzakone's Trojan program is based on an older piece of malware called Gozi. RSA dubbed the new variant Gozi Prinimalka.
The ambitious nature of Project Blitzkrieg and the way it was advertised has led to speculation that it's probably part of a law enforcement sting operation. However, after investigating the Gozi Prinimalka malware, security researchers from McAfee believe the project is authentic and the threat is real.
In a new report published Thursday, they reveal there are two main Prinimalka versions: one dubbed "nah" that dates back to 2008, lending credibility to VorVzakone's claim that the Trojan program has been in development since 2008, and one dubbed "gov" that first appeared in April 2012 and was probably used as a pilot for Project Blitzkrieg.
According to McAfee's report, older attack campaigns based on the "nah" version primarily used command and control servers hosted in the Ukraine, while the more recent attack campaigns based on the "gov" version used servers hosted in Romania,
The first "gov" Prinimalka campaign using servers in Romania started in early August 2012 and the latest one started in October. All of them targeted the customers of U.S. banks.
Based on McAfee telemetry data, the latest activity seen from the October Prinimalka campaign was on Nov. 30, Ryan Sherstobitoff, a McAfee Labs researcher, said Thursday. The fact that a campaign started in October suggests that the project is moving forward, he said.
Several hundred computers in the U.S. are currently infected with Gozi Prinimalka, Sherstobitoff said. It's not clear if attackers are already stealing money from victims' bank accounts, but it's certainly possible, he said.
That said, not everyone whose computer gets infected with the malware will automatically become a victim of bank fraud. The attackers will likely identify the most valuable accounts and focus on those, Sherstobitoff said.
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- Who's Spying on You? You're aware of the threats of malware to your business but what about the ever-changing ground rules? Cybercriminals today are launching attacks against...
- HP HAVEn: See the big picture in Big Data HP HAVEn is the industry's first comprehensive, scalable, open, and secure platform for Big Data. Enterprises are drowning in a sea of data...
- What Datapipe customers need to know about the new PCI DSS 3.0 compliance standard This handy quick reference outlines what PCI DSS 3.0 is, who needs to be compliant and how Alert Logic solutions address the new...
- The 12 PCI DSS 3.0 requirements addressed by Peer 1 Hosting This handy quick reference outlines the 12 PCI DSS 3.0 requirements, who needs to be compliant and how Alert Logic solutions address the...
- Meg Whitman presents Unlocking IT with Big Data During this Web Event you will hear Meg Whitman, President and CEO, HP discuss HAVEn - the #1 Big Data platform, as well...
- The New Way to Work Knowledge Vault This Knowledge Vault focuses on how, in today's increasingly virtual world, it's more important than ever to engage deeply with employees, suppliers, partners,... All Cybercrime and Hacking White Papers | Webcasts